From 2ab6b6b80add51dd1c1fded17a18510cb21bef13 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Tue, 8 Sep 2026 06:23:17 +0200 Subject: [PATCH 1/2] docs: streamline descriptions - literals, references, code --- .../cyclonedx-ai-modelcard-2.0.schema.json | 2 +- .../model/cyclonedx-behavior-2.0.schema.json | 10 ++-- .../model/cyclonedx-blueprint-2.0.schema.json | 14 +++--- .../cyclonedx-certification-2.0.schema.json | 2 +- .../model/cyclonedx-citation-2.0.schema.json | 8 +-- .../model/cyclonedx-common-2.0.schema.json | 14 +++--- .../model/cyclonedx-component-2.0.schema.json | 50 +++++++++---------- .../cyclonedx-composition-2.0.schema.json | 2 +- .../cyclonedx-cryptography-2.0.schema.json | 18 +++---- .../2.0/model/cyclonedx-data-2.0.schema.json | 4 +- .../model/cyclonedx-evidence-2.0.schema.json | 2 +- .../cyclonedx-formulation-2.0.schema.json | 6 +-- ...cyclonedx-jss_X590_2023_10-2.0.schema.json | 16 +++--- .../model/cyclonedx-license-2.0.schema.json | 6 +-- .../model/cyclonedx-metadata-2.0.schema.json | 6 +-- .../2.0/model/cyclonedx-party-2.0.schema.json | 14 +++--- .../model/cyclonedx-physical-2.0.schema.json | 4 +- .../cyclonedx-release-notes-2.0.schema.json | 4 +- .../2.0/model/cyclonedx-risk-2.0.schema.json | 12 ++--- .../model/cyclonedx-threat-2.0.schema.json | 2 +- .../model/cyclonedx-usecase-2.0.schema.json | 8 +-- .../cyclonedx-vulnerability-2.0.schema.json | 4 +- 22 files changed, 104 insertions(+), 104 deletions(-) diff --git a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json index 5bb062879..da31dfe79 100644 --- a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json @@ -9,7 +9,7 @@ "$comment": "Model card support in CycloneDX is derived from TensorFlow Model Card Toolkit released under the Apache 2.0 license and available from https://github.com/tensorflow/model-card-toolkit/blob/main/model_card_toolkit/schema/v0.0.2/model_card.schema.json. In addition, CycloneDX model card support includes portions of VerifyML, also released under the Apache 2.0 license and available from https://github.com/cylynx/verifyml/blob/main/verifyml/model_card_toolkit/schema/v0.0.4/model_card.schema.json.", "type": "object", "title": "Model Card", - "description": "A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.", + "description": "A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component with `type=\"machine-learning-model\"` and must not be specified for other component types.", "additionalProperties": false, "properties": { "bom-ref": { diff --git a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json index ca2b5ca24..25a7f1940 100644 --- a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json @@ -266,7 +266,7 @@ ], "meta:enum": { "activity": "An action that is performed, identified by a behavior, a behavior-instance reference, or a nested graph. The activity-flow counterpart of a step.", - "state": "A durable condition the subject rests in until a transition fires. The state-machine counterpart of a node. A composite state references its nested region through 'graph'.", + "state": "A durable condition the subject rests in until a transition fires. The state-machine counterpart of a node. A composite state references its nested region through `graph`.", "event": "An intermediate event that occurs during the graph.", "gateway": "A branch or merge point whose outgoing transitions carry the guards.", "initial": "The starting point of the graph or of a composite node.", @@ -287,22 +287,22 @@ "type": "integer", "title": "Ordinal", "minimum": 1, - "description": "Position within a sequential graph. Required when the graph ordering is 'sequential'. Ignored when transitions define the order." + "description": "Position within a sequential graph. Required when the graph's `ordering=\"sequential\"`. Ignored when transitions define the order." }, "behavior": { "$ref": "../../behavior-taxonomy.schema.json", "title": "Behavior", - "description": "For an activity node, the behavior performed, drawn from the taxonomy. Mutually exclusive with 'ref' and 'graph'." + "description": "For an activity node, the behavior performed, drawn from the taxonomy. Mutually exclusive with `ref` and `graph`." }, "ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Behavior Reference", - "description": "For an activity node, a reference to a behavior instance. Mutually exclusive with 'behavior' and 'graph'." + "description": "For an activity node, a reference to a behavior instance. Mutually exclusive with `behavior` and `graph`." }, "graph": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Graph Reference", - "description": "A reference to a nested behavior graph. For an activity node it is the sub-process performed and is mutually exclusive with 'behavior' and 'ref'; for a composite node it is the nested region." + "description": "A reference to a nested behavior graph. For an activity node it is the sub-process performed and is mutually exclusive with `behavior` and `ref`; for a composite node it is the nested region." }, "actors": { "type": "array", diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 28a4937b0..363a8c338 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -283,11 +283,11 @@ "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" }, - "description": "The parties that created the blueprint. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `author`." + "description": "The parties that created the blueprint. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `\"author\"`." }, "reviewer": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party that reviewed the blueprint. The party's `roles` should include `reviewer`." + "description": "The party that reviewed the blueprint. The party's `roles` should include `\"reviewer\"`." }, "reviewDate": { "type": "string", @@ -297,7 +297,7 @@ }, "approver": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party that approved the blueprint. The party's `roles` should include `signatory` or a custom role identifying the approving authority." + "description": "The party that approved the blueprint. The party's `roles` should include `\"signatory\"` or a custom role identifying the approving authority." }, "approvalDate": { "type": "string", @@ -410,7 +410,7 @@ }, "componentRef": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to the component this asset represents, including components of type `service`." + "description": "Reference using bom-link or bom-ref to the component this asset represents, including components of type `\"service\"`." }, "partyRef": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -844,7 +844,7 @@ "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" }, - "description": "Parties that own the dataset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `owner`." + "description": "Parties that own the dataset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `\"owner\"`." }, "authorization": { "type": "array", @@ -1727,7 +1727,7 @@ }, "owner": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party responsible for tracking, validating, and maintaining this assumption over the lifecycle of the model. May be an inline party object or a reference to a previously declared party. The party's `roles` should include `owner`." + "description": "The party responsible for tracking, validating, and maintaining this assumption over the lifecycle of the model. May be an inline party object or a reference to a previously declared party. The party's `roles` should include `\"owner\"`." }, "validationMethod": { "type": "string", @@ -1943,7 +1943,7 @@ "ownership": { "type": "array", "title": "Ownership", - "description": "Parties responsible for the asset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` carry the relationship (`owner`, `steward`, `custodian`, `end-user`, or a custom role). Multiple parties may share the same role; preference among them is expressed via `role.order`.", + "description": "Parties responsible for the asset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` carry the relationship (`\"owner\"`, `\"steward\"`, `\"custodian\"`, `\"end-user\"`, or a custom role). Multiple parties may share the same role; preference among them is expressed via `role.order`.", "uniqueItems": true, "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" diff --git a/schema/2.0/model/cyclonedx-certification-2.0.schema.json b/schema/2.0/model/cyclonedx-certification-2.0.schema.json index 05c08f0e8..fcd2a179d 100644 --- a/schema/2.0/model/cyclonedx-certification-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-certification-2.0.schema.json @@ -60,7 +60,7 @@ "jurisdiction": { "type": "string", "title": "Jurisdiction", - "description": "ISO 3166-1 alpha-2 country code, ISO 3166-2 subdivision, or supranational identifier such as `EU`, where the certification applies.", + "description": "ISO 3166-1 alpha-2 country code, ISO 3166-2 subdivision, or supranational identifier such as `\"EU\"`, where the certification applies.", "examples": [ "US", "EU", "GB", "AU", "US-CA" ] }, "level": { diff --git a/schema/2.0/model/cyclonedx-citation-2.0.schema.json b/schema/2.0/model/cyclonedx-citation-2.0.schema.json index f917370c4..7ea40c9a2 100644 --- a/schema/2.0/model/cyclonedx-citation-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-citation-2.0.schema.json @@ -31,7 +31,7 @@ }, "minItems": 1, "title": "Field References", - "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the \"pointers\" or \"expressions\" elements must be present." + "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the `pointers` or `expressions` elements must be present." }, "expressions": { "type": "array", @@ -42,7 +42,7 @@ }, "minItems": 1, "title": "Path Expressions", - "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the \"pointers\" or \"expressions\" elements must be present." + "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the `pointers` or `expressions` elements must be present." }, "timestamp": { "type": "string", @@ -53,12 +53,12 @@ "attributedTo": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Attributed To", - "description": "The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.\nAt least one of the \"attributedTo\" or \"process\" elements must be present." + "description": "The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.\nAt least one of the `attributedTo` or `process` elements must be present." }, "process": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Process Reference", - "description": "The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.\nAt least one of the \"attributedTo\" or \"process\" elements must be present." + "description": "The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.\nAt least one of the `attributedTo` or `process` elements must be present." }, "note": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 6e53d544b..cd3c75952 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -259,7 +259,7 @@ "support": "Community or commercial support", "source-distribution": "The location where the source code distributable can be obtained. This is often an archive format such as zip or tgz. The source-distribution type complements use of the version control (vcs) type.", "distribution": "Direct or repository download location", - "distribution-intake": "The location where a component was published to. This is often the same as \"distribution\" but may also include specialized publishing processes that act as an intermediary.", + "distribution-intake": "The location where a component was published to. This is often the same as `\"distribution\"` but may also include specialized publishing processes that act as an intermediary.", "license": "The reference to the license file. If a license URL has been defined in the license node, it should also be defined as an external reference for completeness.", "build-meta": "Build-system specific meta file (i.e. pom.xml, package.json, .nuspec, etc)", "build-system": "Reference to an automated build system", @@ -285,7 +285,7 @@ "certification-report": "Industry, regulatory, or other certification from an accredited (if applicable) certification body.", "codified-infrastructure": "Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC).", "quality-metrics": "Report or system in which quality metrics can be obtained.", - "poam": "Plans of Action and Milestones (POA&M) complement an \"attestation\" external reference. POA&M is defined by NIST as a \"document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones\".", + "poam": "Plans of Action and Milestones (POA&M) complement an `\"attestation\"` external reference. POA&M is defined by NIST as a \"document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones\".", "perspective": "A CycloneDX perspective defines a domain-specific view, enabling different audiences to interpret and navigate the data through their own conceptual lens.", "electronic-signature": "An e-signature is commonly a scanned representation of a written signature or a stylized script of the person's name.", "digital-signature": "A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.", @@ -294,7 +294,7 @@ "patent-family": "References information about a patent family which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. A patent family is a group of related patent applications or granted patents that cover the same or similar invention. For detailed patent family information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).", "patent-assertion" : "References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.", "citation": "A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.", - "swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the `swid` identifier scheme, which carries only the tagId of a SWID tag.", + "swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the \"swid\" identifier scheme, which carries only the tagId of a SWID tag.", "gs1-digital-link": "A [GS1 Digital Link URI](https://ref.gs1.org/standards/digital-link/uri-syntax/) that connects the component's GS1 identification key, such as a GTIN, to online sources of information, including product data, safety documentation, digital product passports, and recall status. The URI may include key qualifiers, such as a batch or serial number, enabling identification at the class, batch, or individual item level. Component identity shall be derived from the component's identifiers, not from keys embedded in this URI.", "other": "Use this if no other types accurately describe the purpose of the external reference." } @@ -547,7 +547,7 @@ "isoCode": { "type": "string", "title": "ISO Code", - "description": "The country or subdivision of origin, expressed as an ISO 3166-1 alpha-2 country code (for example, 'CA' for Canada) or an ISO 3166-2 subdivision code (for example, 'US-CA' for California, United States).", + "description": "The country or subdivision of origin, expressed as an ISO 3166-1 alpha-2 country code (for example, 'CA' for Canada) or an ISO 3166-2 subdivision code (for example, `\"US-CA\"` for California, United States).", "pattern": "^[A-Z]{2}(-[A-Z0-9]{1,3})?$", "examples": [ "CA", "US-CA" ] }, @@ -597,7 +597,7 @@ "extensibleProperties": { "type": "object", "title": "Extensible Properties", - "$comment": "This is a mixin. It intentionally does NOT restrict additional/unevaluated properties itself; schemas composing it via `allOf` are expected to close themselves with `unevaluatedProperties: false` so that both their own defined properties and these patternProperties remain usable.", + "$comment": "This is a mixin. It intentionally does NOT restrict additional/unevaluated properties itself; schemas composing it via `allOf` are expected to close themselves with `unevaluatedProperties=false` so that both their own defined properties and these patternProperties remain usable.", "patternProperties": { "^ext:[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}:.+$": { "description": "CycloneDX supports a structured and namespace-aware mechanism for extensibility through the use of extensible properties. This mechanism enables organizations, ecosystems, and tool vendors to safely introduce custom properties without conflicting with the core schema or other extensions.\n\nExtensible properties are defined as a JSON object whose keys must conform to a strict pattern that resembles a reverse domain name structure, prefixed with ext:. This pattern provides a namespacing convention that aligns with well-established practices in other structured formats (e.g., XML namespaces).\n\nValues that are objects must declare the schema they conform to via `$schema`. This requirement applies recursively to objects contained in arrays, at any nesting depth.", @@ -650,7 +650,7 @@ "baseObject": { "type": "object", "description": "Base object for all CycloneDX entities. Automatically includes support for extensible properties.", - "$comment": "This is a mixin. It intentionally does NOT set `unevaluatedProperties: false` — that keyword cannot see properties defined by schemas composing this one via `allOf`, and would reject them. Concrete (leaf) schemas composing this mixin must close themselves with `unevaluatedProperties: false`.", + "$comment": "This is a mixin. It intentionally does NOT set `unevaluatedProperties=false` — that keyword cannot see properties defined by schemas composing this one via `allOf`, and would reject them. Concrete (leaf) schemas composing this mixin must close themselves with `unevaluatedProperties=false`.", "allOf": [ { "$ref": "#/$defs/extensibleProperties" } ], @@ -668,7 +668,7 @@ "format": "date-time", "title": "Timestamp", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?Z$", - "description": "An RFC 3339-compliant UTC timestamp using Zulu time (i.e., ending with 'Z'). The format must be 'YYYY-MM-DDTHH:MM:SSZ' or include optional fractional seconds, e.g., 'YYYY-MM-DDTHH:MM:SS.sssZ'. Offsets such as '+00:00' are not allowed." + "description": "An RFC 3339-compliant UTC timestamp using Zulu time (i.e., ending with `\"Z\"`). The format must be `YYYY-MM-DDTHH:MM:SSZ` or include optional fractional seconds, e.g., `YYYY-MM-DDTHH:MM:SS.sssZ`. Offsets such as `\"+00:00\"` are not allowed." }, "ordinalVersion": { "title": "Ordinal Version", diff --git a/schema/2.0/model/cyclonedx-component-2.0.schema.json b/schema/2.0/model/cyclonedx-component-2.0.schema.json index af1b29efd..1a14cc6d0 100644 --- a/schema/2.0/model/cyclonedx-component-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-component-2.0.schema.json @@ -46,14 +46,14 @@ "container": "A packaging and/or runtime format, not specific to any particular technology, which isolates software inside the container from software outside of a container through virtualization technology. Refer to [https://en.wikipedia.org/wiki/OS-level_virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization).", "platform": "A runtime environment that interprets or executes software. This may include runtimes such as those that execute bytecode, just-in-time compilers, interpreters, or low-code/no-code application platforms.", "operating-system": "A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to [https://en.wikipedia.org/wiki/Operating_system](https://en.wikipedia.org/wiki/Operating_system).", - "device": "A hardware device such as a processor or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device. See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).", + "device": "A hardware device such as a processor or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself and another component of `type=\"firmware\"` or `type=\"operating-system\"` (whichever is relevant), describing information about the software running on the device. See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).", "device-driver": "A special type of software that operates or controls a particular type of device. Refer to [https://en.wikipedia.org/wiki/Device_driver](https://en.wikipedia.org/wiki/Device_driver).", "firmware": "A special type of software that provides low-level control over a device's hardware. Refer to [https://en.wikipedia.org/wiki/Firmware](https://en.wikipedia.org/wiki/Firmware).", "file": "A computer file. Refer to [https://en.wikipedia.org/wiki/Computer_file](https://en.wikipedia.org/wiki/Computer_file) for information about files.", "machine-learning-model": "A model based on training data that can make predictions or decisions without being explicitly programmed to do so.", "data": "A collection of discrete values that convey information.", "cryptographic-asset": "A cryptographic asset including algorithms, protocols, certificates, keys, tokens, and secrets.", - "material": "A physical substance in raw or processed form that is used to make, maintain, or repair an item, such as a metal, alloy, polymer, chemical, or other matter. Materials are commonly tracked for sourcing, provenance, and regulatory compliance. A finished physical item should be classified as 'device' instead.", + "material": "A physical substance in raw or processed form that is used to make, maintain, or repair an item, such as a metal, alloy, polymer, chemical, or other matter. Materials are commonly tracked for sourcing, provenance, and regulatory compliance. A finished physical item should be classified as 'type=\"device\"` instead.", "service": "A service, including microservices, function-as-a-service, and other types of network or intra-process services. Service-specific attributes, endpoints and the data profiles characterizing the data the service handles, apply exclusively to this component type." }, "title": "Component Type", @@ -97,17 +97,17 @@ "version": { "$ref": "#/$defs/version", "title": "Component Version", - "description": "The component version. The version should ideally comply with semantic versioning but is not enforced.\nMust be used exclusively, either 'version' or 'versionRange', but not both." + "description": "The component version. The version should ideally comply with semantic versioning but is not enforced.\nMust be used exclusively, either `version` or `versionRange`, but not both." }, "versionRange": { "$ref": "#/$defs/versionRange", "title": "Component Version Range", - "description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at Date: Tue, 8 Sep 2026 07:44:12 +0200 Subject: [PATCH 2/2] docs: streamline descriptions - literals, references, code Signed-off-by: Jan Kowalleck --- schema/2.0/cyclonedx-2.0.schema.json | 6 +++--- .../model/cyclonedx-blueprint-2.0.schema.json | 4 ++-- .../2.0/model/cyclonedx-common-2.0.schema.json | 6 +++--- .../model/cyclonedx-component-2.0.schema.json | 10 +++++----- .../2.0/model/cyclonedx-control-2.0.schema.json | 2 +- .../model/cyclonedx-cryptography-2.0.schema.json | 6 +++--- schema/2.0/model/cyclonedx-data-2.0.schema.json | 2 +- .../model/cyclonedx-declaration-2.0.schema.json | 4 ++-- .../2.0/model/cyclonedx-evidence-2.0.schema.json | 2 +- .../cyclonedx-jss_X590_2023_10-2.0.schema.json | 2 +- schema/2.0/model/cyclonedx-party-2.0.schema.json | 2 +- .../2.0/model/cyclonedx-patent-2.0.schema.json | 2 +- .../model/cyclonedx-perspective-2.0.schema.json | 2 +- .../2.0/model/cyclonedx-physical-2.0.schema.json | 2 +- .../model/cyclonedx-requirement-2.0.schema.json | 2 +- schema/2.0/model/cyclonedx-risk-2.0.schema.json | 16 ++++++++-------- .../2.0/model/cyclonedx-usecase-2.0.schema.json | 2 +- .../cyclonedx-vulnerability-2.0.schema.json | 2 +- 18 files changed, 37 insertions(+), 37 deletions(-) diff --git a/schema/2.0/cyclonedx-2.0.schema.json b/schema/2.0/cyclonedx-2.0.schema.json index 8e7573861..79de8140f 100644 --- a/schema/2.0/cyclonedx-2.0.schema.json +++ b/schema/2.0/cyclonedx-2.0.schema.json @@ -18,7 +18,7 @@ "specFormat": { "type": "string", "title": "Specification Format", - "description": "Specifies the format. This value shall be \"CycloneDX\".", + "description": "Specifies the format. This value shall be `\"CycloneDX\"`.", "enum": [ "CycloneDX" ] @@ -43,7 +43,7 @@ "version": { "type": "integer", "title": "BOM Version", - "description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.", + "description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is `1`.", "minimum": 1, "default": 1 }, @@ -52,7 +52,7 @@ }, "components": { "$ref": "model/cyclonedx-component-2.0.schema.json#/$defs/components", - "description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the metadata component is omitted, the array provides component data for interchange purposes without establishing a compositional relationship." + "description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the `metadata.component` is omitted, the array provides component data for interchange purposes without establishing a compositional relationship." }, "dependencies": { "$ref": "model/cyclonedx-dependency-2.0.schema.json#/$defs/dependencies" diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 363a8c338..62c99dfc9 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -338,7 +338,7 @@ "type": "string", "title": "Review Frequency", "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?$", - "description": "ISO 8601 duration for review frequency (e.g., P3M for quarterly)." + "description": "ISO 8601 duration for review frequency (e.g., `\"P3M\"` for quarterly)." } } }, @@ -967,7 +967,7 @@ }, "dataFormat": { "type": "string", - "description": "Data format (e.g., JSON, XML, Protocol Buffers)." + "description": "Data format (e.g., `\"JSON\"`, `\"XML\"`, `\"Protocol Buffers\"`)." }, "authentication": { "type": "array", diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index cd3c75952..e8acf76a3 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -531,7 +531,7 @@ "distribution": { "type": "array", "title": "Origin Distribution", - "description": "The distribution of the origin across regions. The percentages of all entries shall total 100, within rounding of the stated precision.", + "description": "The distribution of the origin across regions. The percentages of all entries shall total `100`, within rounding of the stated precision.", "minItems": 1, "items": { "$ref": "#/$defs/originRegion" } } @@ -554,7 +554,7 @@ "percentage": { "type": "number", "title": "Percentage", - "description": "The percentage of the whole attributable to this region. The percentages of all entries in a distribution must total 100, within rounding of the stated precision.", + "description": "The percentage of the whole attributable to this region. The percentages of all entries in a distribution must total `100`, within rounding of the stated precision.", "minimum": 0, "maximum": 100 }, @@ -959,7 +959,7 @@ "type": "string", "pattern": "^([a-z]{2})(-[A-Z]{2})?$", "title": "Locale", - "description": "Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: en, en-US, fr, fr-CA" + "description": "Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: `\"en\"`, `\"en-US\"`, `\"fr\"`, `\"fr-CA\"`." }, "signatures": { "$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatures", diff --git a/schema/2.0/model/cyclonedx-component-2.0.schema.json b/schema/2.0/model/cyclonedx-component-2.0.schema.json index 1a14cc6d0..1ffb6bef3 100644 --- a/schema/2.0/model/cyclonedx-component-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-component-2.0.schema.json @@ -91,7 +91,7 @@ "name": { "type": "string", "title": "Component Name", - "description": "The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery", + "description": "The name of the component. This will often be a shortened, single name of the component. Examples: `\"commons-lang3\"` and `\"jquery\"`.", "examples": ["tomcat-catalina"] }, "version": { @@ -207,7 +207,7 @@ "items": {"$ref": "#/$defs/componentOrChoice"}, "uniqueItems": true, "title": "Components", - "description": "A list of components included in the parent component, including software, hardware, and services. Entries may be concrete components or component-choice wrappers expressing conditional or alternate relationships. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system → subsystem → parts assembly in physical supply chains." + "description": "A list of components included in the parent component, including software, hardware, and services. Entries may be concrete components or component-choice wrappers expressing conditional or alternate relationships. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system → subsystem → parts assembly in physical supply chains." }, "evidence": { "$ref": "#/$defs/componentEvidence", @@ -562,7 +562,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "The overall confidence of the detection from 0 to 1, where 1 is 100% confidence." + "description": "The overall confidence of the detection from `0` to `1`, where `1` is 100% confidence." }, "methods": { "type": "array", @@ -622,7 +622,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "The overall confidence of the detection from 0 to 1, where 1 is 100% confidence." + "description": "The overall confidence of the detection from `0` to `1`, where `1` is 100% confidence." }, "methods": { "type": "array", @@ -675,7 +675,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence." + "description": "The overall confidence of the evidence from `0` to `1`, where `1` is 100% confidence." }, "concludedValue": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-control-2.0.schema.json b/schema/2.0/model/cyclonedx-control-2.0.schema.json index e7762a1e7..e6c8fe0b3 100644 --- a/schema/2.0/model/cyclonedx-control-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-control-2.0.schema.json @@ -202,7 +202,7 @@ "minimum": 0, "maximum": 1, "title": "Percentage", - "description": "Effectiveness as a decimal from 0 to 1." + "description": "Effectiveness as a decimal from `0` to `1`." }, "rating": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-cryptography-2.0.schema.json b/schema/2.0/model/cyclonedx-cryptography-2.0.schema.json index 0617b4d1e..6640a7afc 100644 --- a/schema/2.0/model/cyclonedx-cryptography-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-cryptography-2.0.schema.json @@ -40,7 +40,7 @@ "primitive": { "type": "string", "title": "primitive", - "description": "Cryptographic building blocks used in higher-level cryptographic systems and protocols. Primitives represent different cryptographic routines: deterministic random bit generators (drbg, e.g. CTR_DRBG from NIST SP800-90A-r1), message authentication codes (mac, e.g. HMAC-SHA-256), blockciphers (e.g. AES), streamciphers (e.g. Salsa20), signatures (e.g. ECDSA), hash functions (e.g. SHA-256), public-key encryption schemes (pke, e.g. RSA), extended output functions (xof, e.g. SHAKE256), key derivation functions (e.g. pbkdf2), key agreement algorithms (e.g. ECDH), key encapsulation mechanisms (e.g. ML-KEM), authenticated encryption (ae, e.g. AES-GCM) and the combination of multiple algorithms (combiner, e.g. SP800-56Cr2).", + "description": "Cryptographic building blocks used in higher-level cryptographic systems and protocols. Primitives represent different cryptographic routines: deterministic random bit generators (`\"drbg\"`, e.g. CTR_DRBG from NIST SP800-90A-r1), message authentication codes (`\"mac\"`, e.g. HMAC-SHA-256), blockciphers (e.g. AES), streamciphers (e.g. Salsa20), signatures (e.g. ECDSA), hash functions (e.g. SHA-256), public-key encryption schemes (`\"pke`\", e.g. RSA), extended output functions (`\"xof\"`, e.g. SHAKE256), key derivation functions (e.g. pbkdf2), key agreement algorithms (e.g. ECDH), key encapsulation mechanisms (e.g. ML-KEM), authenticated encryption (`\"ae\"`, e.g. AES-GCM) and the combination of multiple algorithms (`\"combiner\"`, e.g. SP800-56Cr2).", "enum": [ "drbg", "mac", @@ -91,7 +91,7 @@ "parameterSetIdentifier": { "type": "string", "title": "Parameter Set Identifier", - "description": "An identifier for the parameter set of the cryptographic algorithm. Examples: in AES128, `128` identifies the key length in bits, in SHA256, `256` identifies the digest length, `128` in SHAKE128 identifies its maximum security level in bits, and `\"SHA2-128s\"` identifies a parameter set used in SLH-DSA (FIPS205)." + "description": "An identifier for the parameter set of the cryptographic algorithm. Examples: in AES128, `\"128\"` identifies the key length in bits, in SHA256, `\"256\"` identifies the digest length, `\"128\"` in SHAKE128 identifies its maximum security level in bits, and `\"SHA2-128s\"` identifies a parameter set used in SLH-DSA (FIPS205)." }, "ellipticCurve": { "$ref": "../../cryptography-defs.schema.json#/definitions/ellipticCurvesEnum", @@ -722,7 +722,7 @@ "format": { "type": "string", "title": "Format", - "description": "The format of the related cryptographic material (e.g. P8, PEM, DER)." + "description": "The format of the related cryptographic material (e.g. `\"P8\"`, `\"PEM\"`, `\"DER\"`)." }, "securedBy": { "$ref": "#/$defs/securedBy", diff --git a/schema/2.0/model/cyclonedx-data-2.0.schema.json b/schema/2.0/model/cyclonedx-data-2.0.schema.json index 226940793..e8560f12e 100644 --- a/schema/2.0/model/cyclonedx-data-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-data-2.0.schema.json @@ -337,7 +337,7 @@ "format": { "type": "object", "title": "Format", - "description": "The serialisation or encoding format of this object, such as application/json, text/csv, or application/hl7-v2.", + "description": "The serialisation or encoding format of this object, such as `\"application/json\"`, `\"text/csv\"`, or `\"application/hl7-v2\"`.", "additionalProperties": false, "properties": { "url": { diff --git a/schema/2.0/model/cyclonedx-declaration-2.0.schema.json b/schema/2.0/model/cyclonedx-declaration-2.0.schema.json index 951e5a807..4e3e998e7 100644 --- a/schema/2.0/model/cyclonedx-declaration-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-declaration-2.0.schema.json @@ -95,7 +95,7 @@ "minimum": 0, "maximum": 1, "title": "Score", - "description": "The conformance of the claim between and inclusive of 0 and 1, where 1 is 100% conformance." + "description": "The conformance of the claim between and inclusive of `0` and `1`, where `1` is 100% conformance." }, "rationale": { "type": "string", @@ -121,7 +121,7 @@ "minimum": 0, "maximum": 1, "title": "Score", - "description": "The confidence of the claim between and inclusive of 0 and 1, where 1 is 100% confidence." + "description": "The confidence of the claim between and inclusive of `0` and `1`, where `1` is 100% confidence." }, "rationale": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-evidence-2.0.schema.json b/schema/2.0/model/cyclonedx-evidence-2.0.schema.json index 53a898f13..46a89bda0 100644 --- a/schema/2.0/model/cyclonedx-evidence-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-evidence-2.0.schema.json @@ -179,7 +179,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "The confidence of the evidence from 0 to 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence." + "description": "The confidence of the evidence from `0` to `1`, where `1` is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence." }, "value": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-jss_X590_2023_10-2.0.schema.json b/schema/2.0/model/cyclonedx-jss_X590_2023_10-2.0.schema.json index 24f65761c..24b23322f 100644 --- a/schema/2.0/model/cyclonedx-jss_X590_2023_10-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-jss_X590_2023_10-2.0.schema.json @@ -44,7 +44,7 @@ }, "hashAlgorithm": { "title": "Hash Algorithm", - "description": "This property identifies the hashing algorithm, as defined by the Internet Assigned Numbers Authority (IANA)…, that was used to hash the JCS version of the full JSON object (JSON Object + JSS Signature) and is a case-sensitive ASCII string. Implementations MAY use any current and widely accepted hashing algorithm (e.g., sha-256, sha-512) that is defined in the IANA registry. The actual signing process, defined in the algorithm property, sometimes uses an internal hashing algorithm inside the signing process itself, this property MAY identify the same hashing algorithm as the signing process or MAY identify a different hashing algorithm.", + "description": "This property identifies the hashing algorithm, as defined by the Internet Assigned Numbers Authority (IANA)…, that was used to hash the JCS version of the full JSON object (JSON Object + JSS Signature) and is a case-sensitive ASCII string. Implementations MAY use any current and widely accepted hashing algorithm (e.g., `\"sha-256\"`, `\"sha-512\"`) that is defined in the IANA registry. The actual signing process, defined in the algorithm property, sometimes uses an internal hashing algorithm inside the signing process itself, this property MAY identify the same hashing algorithm as the signing process or MAY identify a different hashing algorithm.", "$comment": "Normative source: ITU-T X.590 clause 6.2.1", "type": "string", "pattern": "^[a-z0-9-]+$", diff --git a/schema/2.0/model/cyclonedx-party-2.0.schema.json b/schema/2.0/model/cyclonedx-party-2.0.schema.json index d756269de..ab7d29d7f 100644 --- a/schema/2.0/model/cyclonedx-party-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-party-2.0.schema.json @@ -72,7 +72,7 @@ "parties": { "type": "array", "title": "Parties", - "description": "Parties associated with the subject. Each item identifies an organization, individual, system, or abstract archetype playing one or more named roles such as manufacturer, supplier, author, integrator, quality-control, or any custom role. The same party can hold multiple roles, each independently ranked via `role.order` to express preference (for example, primary supplier with order 1 and alternate supplier with order 2). Items may be inline party objects or references to parties declared elsewhere.", + "description": "Parties associated with the subject. Each item identifies an organization, individual, system, or abstract archetype playing one or more named roles such as manufacturer, supplier, author, integrator, quality-control, or any custom role. The same party can hold multiple roles, each independently ranked via `role.order` to express preference (for example, primary supplier with order `1` and alternate supplier with order `2`). Items may be inline party objects or references to parties declared elsewhere.", "items": { "$ref": "#/$defs/partyChoice" } }, "partyChoice": { diff --git a/schema/2.0/model/cyclonedx-patent-2.0.schema.json b/schema/2.0/model/cyclonedx-patent-2.0.schema.json index a97180786..071b982db 100644 --- a/schema/2.0/model/cyclonedx-patent-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-patent-2.0.schema.json @@ -48,7 +48,7 @@ "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9\\-/.()\\s]{0,28}[A-Za-z0-9]$", "title": "Patent Publication Number", - "description": "This is the number assigned to a patent application once it is published. Patent applications are generally published 18 months after filing (unless an applicant requests non-publication). This number is distinct from the application number. \n\nPurpose: Identifies the publicly available version of the application. \n\nFormat: Varies by jurisdiction, often similar to application numbers but includes an additional suffix indicating publication. \n\nExample:\n - US: US20240000123A1 (indicates the first publication of application US20240000123) \n - Europe: EP23123456A1 (first publication of European application EP23123456). \n\nWIPO ST.96 v8.0: \n - Publication Number field: https://www.wipo.int/standards/XMLSchema/ST96/V8_0/Patent/PublicationNumber.xsd" + "description": "This is the number assigned to a patent application once it is published. Patent applications are generally published 18 months after filing (unless an applicant requests non-publication). This number is distinct from the application number. \n\nPurpose: Identifies the publicly available version of the application. \n\nFormat: Varies by jurisdiction, often similar to application numbers but includes an additional suffix indicating publication. \n\nExample:\n - US: `\"US20240000123A1\"` (indicates the first publication of application US20240000123) \n - Europe: `\"EP23123456A1\"` (first publication of European application EP23123456). \n\nWIPO ST.96 v8.0: \n - Publication Number field: https://www.wipo.int/standards/XMLSchema/ST96/V8_0/Patent/PublicationNumber.xsd" }, "title": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-perspective-2.0.schema.json b/schema/2.0/model/cyclonedx-perspective-2.0.schema.json index 217cf5870..207370a4f 100644 --- a/schema/2.0/model/cyclonedx-perspective-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-perspective-2.0.schema.json @@ -108,7 +108,7 @@ "weight": { "type": "number", "title": "Weight", - "description": "Describes the importance of a field in relation to other fields. Values shall be between 0.0 and 1.0. This allows for relative ranking of mappings, where higher values indicate greater importance.", + "description": "Describes the importance of a field in relation to other fields. Values shall be between `0.0` and `1.0`. This allows for relative ranking of mappings, where higher values indicate greater importance.", "minimum": 0.0, "maximum": 1.0 }, diff --git a/schema/2.0/model/cyclonedx-physical-2.0.schema.json b/schema/2.0/model/cyclonedx-physical-2.0.schema.json index 7d489ab8e..6aff226b4 100644 --- a/schema/2.0/model/cyclonedx-physical-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-physical-2.0.schema.json @@ -79,7 +79,7 @@ "uniqueItems": true, "minItems": 1, "title": "Designators", - "description": "Reference designators identifying the placement on the assembly, such as U5, R12, C3.", + "description": "Reference designators identifying the placement on the assembly, such as `\"U5\"`, `\"R12\"`, `\"C3`\".", "examples": [ [ "U5" ], [ "C3", "C4", "C9", "C11", "C14", "C15" ] ] }, "layer": { diff --git a/schema/2.0/model/cyclonedx-requirement-2.0.schema.json b/schema/2.0/model/cyclonedx-requirement-2.0.schema.json index d141b1b67..c3ff0f1e7 100644 --- a/schema/2.0/model/cyclonedx-requirement-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-requirement-2.0.schema.json @@ -29,7 +29,7 @@ "id": { "type": "string", "title": "Identifier", - "description": "A unique identifier for the requirement, often used in requirement management systems (e.g., REQ-001)." + "description": "A unique identifier for the requirement, often used in requirement management systems (e.g., `\"REQ-001\"`)." }, "name": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index d78e90ca0..fd17c3ab1 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -406,7 +406,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "Confidence in this rating, expressed as a decimal from 0 to 1, where 1 is full confidence. Supports quantitative methods that reason over uncertainty." + "description": "Confidence in this rating, expressed as a decimal from `0` to `1`, where `1` is full confidence. Supports quantitative methods that reason over uncertainty." }, "rationale": { "type": "string", @@ -452,13 +452,13 @@ "type": "number", "minimum": 0, "maximum": 1, - "description": "Probability as a decimal from 0 to 1." + "description": "Probability as a decimal from `0` to `1`." }, "frequency": { "type": "number", "minimum": 0, "title": "Frequency", - "description": "The expected number of events within the timeframe, for frequency-based methods such as the [FAIR](https://www.fairinstitute.org/) loss event frequency. Unlike a probability, a frequency may exceed 1." + "description": "The expected number of events within the timeframe, for frequency-based methods such as the [FAIR](https://www.fairinstitute.org/) loss event frequency. Unlike a probability, a frequency may exceed `1`." }, "timeframe": { "type": "string", @@ -589,7 +589,7 @@ "weight": { "type": "number", "title": "Weight", - "description": "The relative importance or weight of this factor in the overall likelihood calculation, expressed as a decimal between 0 and 1. When multiple factors are present, weights can be used to produce a weighted average likelihood score. A weight of 1 indicates full importance; a weight of 0 indicates no importance.", + "description": "The relative importance or weight of this factor in the overall likelihood calculation, expressed as a decimal between `0` and `1`. When multiple factors are present, weights can be used to produce a weighted average likelihood score. A weight of `1` indicates full importance; a weight of `0` indicates no importance.", "minimum": 0, "maximum": 1 }, @@ -785,7 +785,7 @@ "minimum": 0, "maximum": 1, "title": "Weight", - "description": "The relative importance of this factor in the overall impact calculation, expressed as a decimal from 0 to 1. OCTAVE Allegro, for example, ranks impact areas and multiplies the ranking by the factor value." + "description": "The relative importance of this factor in the overall impact calculation, expressed as a decimal from `0` to `1`. OCTAVE Allegro, for example, ranks impact areas and multiplies the ranking by the factor value." }, "description": { "type": "string", @@ -912,13 +912,13 @@ "qualitative-matrix" ], "meta:enum": { - "dread": "[DREAD](https://en.wikipedia.org/wiki/DREAD_%28risk_assessment_model%29) risk rating model, the average of five ratings (damage, reproducibility, exploitability, affected users, discoverability) each scored 1 to 10.", + "dread": "[DREAD](https://en.wikipedia.org/wiki/DREAD_%28risk_assessment_model%29) risk rating model, the average of five ratings (damage, reproducibility, exploitability, affected users, discoverability) each scored `1` to `10`.", "fair": "[Factor Analysis of Information Risk (FAIR)](https://www.fairinstitute.org/), a quantitative methodology expressing risk as loss event frequency multiplied by loss magnitude.", "fmea": "[Failure Mode and Effects Analysis (FMEA)](https://asq.org/quality-resources/fmea), using a risk priority number of severity multiplied by occurrence multiplied by detection.", "nist-sp-800-30": "[NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final) guide for conducting risk assessments, using its exemplary likelihood and impact scales.", "octave": "[OCTAVE Allegro](https://www.sei.cmu.edu/documents/786/2007_005_001_14885.pdf), using its relative risk score.", - "owasp-risk-rating": "[OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), averaging likelihood and impact factors each scored 0 to 9.", - "qualitative-matrix": "A qualitative risk matrix that derives a risk level by plotting a likelihood band against an impact band, such as a five by five matrix producing a score from 1 to 25." + "owasp-risk-rating": "[OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), averaging likelihood and impact factors each scored `0` to `9`.", + "qualitative-matrix": "A qualitative risk matrix that derives a risk level by plotting a likelihood band against an impact band, such as a five by five matrix producing a score from `1` to `25`." } }, { diff --git a/schema/2.0/model/cyclonedx-usecase-2.0.schema.json b/schema/2.0/model/cyclonedx-usecase-2.0.schema.json index 3c7ef28e5..45dd0bafe 100644 --- a/schema/2.0/model/cyclonedx-usecase-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-usecase-2.0.schema.json @@ -147,7 +147,7 @@ "type": "integer", "title": "Number", "minimum": 1, - "description": "The sequence number indicating the ordinal position of this step within its flow, starting at 1." + "description": "The sequence number indicating the ordinal position of this step within its flow, starting at `1`." }, "description": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json index b2cb5180e..6f90b6caf 100644 --- a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json @@ -592,7 +592,7 @@ "minimum": 0, "maximum": 1, "title": "Confidence", - "description": "The overall confidence of the determination from 0 to 1, where 1 is 100% confidence." + "description": "The overall confidence of the determination from `0` to `1`, where `1` is 100% confidence." }, "concludedValue": { "type": "string",